Extends ISO/IEC 27002:2013 5.1.1. The processor's security policies gain a statement that it supports, and is committed to, complying with the PII protection law that applies to it and with the terms agreed in each customer contract. Those contracts split responsibilities plainly among the processor, its sub-contractors and the customer, and the split turns on the kind of service: application-layer controls, for instance, may be the processor's under a SaaS offering but the customer's when it builds its own applications on PaaS or IaaS. Other information: some jurisdictions bind the processor directly by PII law while others bind only the controller; in both cases the customer contract is what obliges the processor to support compliance, and it may ask for independently audited compliance the customer accepts, for example by implementing the controls of this document and ISO/IEC 27002.
This control maps to 3 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.